Administrators currently manage city firewalls from the same in-band production networks used by employees. Which management approach is preferred where practical?
Select an answer to reveal the explanation.
Short Explanation
Don’t drive the fire truck from the crowded freeway if you can use a private service road. Out-of-band management keeps admin access off the same roads attackers and malware already ride.
Full Explanation
Managing city firewalls from the same in-band production networks employees use exposes administrative interfaces to malware, lateral movement, and credential phishing already present on user VLANs. A managed out-of-band management network—or an equivalently isolated path with jump hosts, strong authentication, and tightly limited admin access—keeps the keys to the kingdom off the crowded freeway. Isolation improves accountability, reduces accidental exposure of HTTPS or SSH admin listeners, and allows stricter monitoring of who touches perimeter devices.
Exposing firewall HTTPS admin interfaces on the public Internet with a memorable password invites global brute force and exploitation of management-plane bugs. Allowing any VPN user full admin rights without MFA to speed incident response collapses least privilege and multi-factor expectations at the worst possible moment. Managing firewalls only via cleartext Telnet from Wi-Fi guest networks during business hours combines the weakest protocol with the least trusted wireless segment.
Exam caveat: CISSP management-plane security favors out-of-band or strongly isolated admin paths with MFA and jump hosts. Internet-exposed admin UIs and cleartext management are consistently wrong.
Operational check: move firewall management addresses to OOB or management VRF; require jump-host MFA; block production user VLANs from admin ports; disable Telnet; and alert on any admin login sourced from unexpected networks.